CVE-2026-39518

WordPress EventPrime plugin <= 4.3.0.0 - Insecure Direct Object References (IDOR) vulnerability

7.1 High

CVE-2026-39518 is a high vulnerability (CVSS 7.1) in Eventprime, published June 15, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. No source names a fixed version.

What does this mean?

Severity: 7.1 HighCVSS 3.1, CVE List
Exploit chance: 0.28%EPSS, 20th percentile
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: No fix listedNo source names one

Description

Subscriber Insecure Direct Object References (IDOR) in EventPrime <= 4.3.0.0 versions.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: Low
Availability: None

Exploit likelihood

0.28%Unchanged since Jun 16, 2026

Affected products

What each source reports

CVE List Score used7.1

WordPress EventPrime plugin <= 4.3.0.0 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References (IDOR) in EventPrime <= 4.3.0.0 versions.

Record: CVE-2026-39518
CVSS 3.1: 7.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Weakness: CWE-639
Updated: 2026-11-02

EUVDEUVD-2026-369557.1

Subscriber Insecure Direct Object References (IDOR) in EventPrime <= 4.3.0.0 versions.

Record: EUVD-2026-36955
CVSS 3.1: 7.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-fgrh-26m2-w86v7.1

Subscriber Insecure Direct Object References (IDOR) in EventPrime <= 4.3.0.0 versions.

Subscriber Insecure Direct Object References (IDOR) in EventPrime <= 4.3.0.0 versions.

Record: GHSA-fgrh-26m2-w86v
CVSS 3.1: 7.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Weakness: CWE-639
Updated: 2026-11-02

NVD7.1

Subscriber Insecure Direct Object References (IDOR) in EventPrime <= 4.3.0.0 versions.

Record: CVE-2026-39518
CVSS 3.1: 7.1 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Weakness: CWE-639
Updated: 2026-11-02

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.